diff --git a/daemons/ganeti-confd b/daemons/ganeti-confd index d19bfad0618d79187b0699faf3e8947b44a58b99..82734ef1f0b6b9e4b6417123f03ed3cda7c05668 100755 --- a/daemons/ganeti-confd +++ b/daemons/ganeti-confd @@ -335,8 +335,8 @@ def CheckConfd(_, args): # TODO: collapse HMAC daemons handling in daemons GenericMain, when we'll # have more than one. - if not os.path.isfile(constants.HMAC_CLUSTER_KEY): - print >> sys.stderr, "Need HMAC key %s to run" % constants.HMAC_CLUSTER_KEY + if not os.path.isfile(constants.CONFD_HMAC_KEY): + print >> sys.stderr, "Need HMAC key %s to run" % constants.CONFD_HMAC_KEY sys.exit(constants.EXIT_FAILURE) diff --git a/lib/backend.py b/lib/backend.py index e16a321c82b068fc82494edbc4e0c0eb861d9a35..601a3f3627debdecb8f7ad903485b9d4cc674b3b 100644 --- a/lib/backend.py +++ b/lib/backend.py @@ -183,7 +183,7 @@ def _BuildUploadFileList(): constants.VNC_PASSWORD_FILE, constants.RAPI_CERT_FILE, constants.RAPI_USERS_FILE, - constants.HMAC_CLUSTER_KEY, + constants.CONFD_HMAC_KEY, ]) for hv_name in constants.HYPER_TYPES: @@ -399,7 +399,7 @@ def LeaveCluster(modify_ssh_setup): logging.exception("Error while processing ssh files") try: - utils.RemoveFile(constants.HMAC_CLUSTER_KEY) + utils.RemoveFile(constants.CONFD_HMAC_KEY) utils.RemoveFile(constants.RAPI_CERT_FILE) utils.RemoveFile(constants.NODED_CERT_FILE) except: # pylint: disable-msg=W0702 diff --git a/lib/bootstrap.py b/lib/bootstrap.py index 3647ad84205edb45509724d0971d1f9db9d611c3..9f997c07e27c2e32c2d8fb90ae23071757f532e7 100644 --- a/lib/bootstrap.py +++ b/lib/bootstrap.py @@ -111,7 +111,7 @@ def GenerateHmacKey(file_name): backup=True) -def GenerateClusterCrypto(new_cluster_cert, new_rapi_cert, new_hmac_key, +def GenerateClusterCrypto(new_cluster_cert, new_rapi_cert, new_confd_hmac_key, rapi_cert_pem=None): """Updates the cluster certificates, keys and secrets. @@ -119,8 +119,8 @@ def GenerateClusterCrypto(new_cluster_cert, new_rapi_cert, new_hmac_key, @param new_cluster_cert: Whether to generate a new cluster certificate @type new_rapi_cert: bool @param new_rapi_cert: Whether to generate a new RAPI certificate - @type new_hmac_key: bool - @param new_hmac_key: Whether to generate a new HMAC key + @type new_confd_hmac_key: bool + @param new_confd_hmac_key: Whether to generate a new HMAC key @type rapi_cert_pem: string @param rapi_cert_pem: New RAPI certificate in PEM format @@ -135,10 +135,10 @@ def GenerateClusterCrypto(new_cluster_cert, new_rapi_cert, new_hmac_key, constants.NODED_CERT_FILE) GenerateSelfSignedSslCert(constants.NODED_CERT_FILE) - # HMAC key - if new_hmac_key or not os.path.exists(constants.HMAC_CLUSTER_KEY): - logging.debug("Writing new HMAC key to %s", constants.HMAC_CLUSTER_KEY) - GenerateHmacKey(constants.HMAC_CLUSTER_KEY) + # confd HMAC key + if new_confd_hmac_key or not os.path.exists(constants.CONFD_HMAC_KEY): + logging.debug("Writing new confd HMAC key to %s", constants.CONFD_HMAC_KEY) + GenerateHmacKey(constants.CONFD_HMAC_KEY) # RAPI rapi_cert_exists = os.path.exists(constants.RAPI_CERT_FILE) @@ -428,14 +428,14 @@ def SetupNodeDaemon(cluster_name, node, ssh_key_check): noded_cert = utils.ReadFile(constants.NODED_CERT_FILE) rapi_cert = utils.ReadFile(constants.RAPI_CERT_FILE) - hmac_key = utils.ReadFile(constants.HMAC_CLUSTER_KEY) + confd_hmac_key = utils.ReadFile(constants.CONFD_HMAC_KEY) # in the base64 pem encoding, neither '!' nor '.' are valid chars, # so we use this to detect an invalid certificate; as long as the # cert doesn't contain this, the here-document will be correctly # parsed by the shell sequence below. HMAC keys are hexadecimal strings, # so the same restrictions apply. - for content in (noded_cert, rapi_cert, hmac_key): + for content in (noded_cert, rapi_cert, confd_hmac_key): if re.search('^!EOF\.', content, re.MULTILINE): raise errors.OpExecError("invalid SSL certificate or HMAC key") @@ -443,8 +443,8 @@ def SetupNodeDaemon(cluster_name, node, ssh_key_check): noded_cert += "\n" if not rapi_cert.endswith("\n"): rapi_cert += "\n" - if not hmac_key.endswith("\n"): - hmac_key += "\n" + if not confd_hmac_key.endswith("\n"): + confd_hmac_key += "\n" # set up inter-node password and certificate and restarts the node daemon # and then connect with ssh to set password and start ganeti-noded @@ -461,9 +461,9 @@ def SetupNodeDaemon(cluster_name, node, ssh_key_check): "%s start %s" % (constants.NODED_CERT_FILE, noded_cert, constants.RAPI_CERT_FILE, rapi_cert, - constants.HMAC_CLUSTER_KEY, hmac_key, + constants.CONFD_HMAC_KEY, confd_hmac_key, constants.NODED_CERT_FILE, constants.RAPI_CERT_FILE, - constants.HMAC_CLUSTER_KEY, + constants.CONFD_HMAC_KEY, constants.DAEMON_UTIL, constants.NODED)) result = sshrunner.Run(node, 'root', mycommand, batch=False, diff --git a/lib/cli.py b/lib/cli.py index 51c239c09cdf902ca6eab74ff5190ddd39e09f3c..e4e0fe8087cf02e719f64d42d4ba7eed03c67e4d 100644 --- a/lib/cli.py +++ b/lib/cli.py @@ -80,7 +80,7 @@ __all__ = [ "MC_OPT", "NET_OPT", "NEW_CLUSTER_CERT_OPT", - "NEW_HMAC_KEY_OPT", + "NEW_CONFD_HMAC_KEY_OPT", "NEW_RAPI_CERT_OPT", "NEW_SECONDARY_OPT", "NIC_PARAMS_OPT", @@ -878,9 +878,11 @@ NEW_RAPI_CERT_OPT = cli_option("--new-rapi-certificate", dest="new_rapi_cert", help=("Generate a new self-signed RAPI" " certificate")) -NEW_HMAC_KEY_OPT = cli_option("--new-hmac-key", dest="new_hmac_key", - default=False, action="store_true", - help="Create a new HMAC key") +NEW_CONFD_HMAC_KEY_OPT = cli_option("--new-confd-hmac-key", + dest="new_confd_hmac_key", + default=False, action="store_true", + help=("Create a new HMAC key for %s" % + constants.CONFD)) def _ParseArgs(argv, commands, aliases): diff --git a/lib/cmdlib.py b/lib/cmdlib.py index b898469d6627efc393c104ddc1a0b3e56f97057e..32fdef9af25da0a3359ef93ae1a5967b4087bf1d 100644 --- a/lib/cmdlib.py +++ b/lib/cmdlib.py @@ -2280,7 +2280,7 @@ def _RedistributeAncillaryFiles(lu, additional_nodes=None): constants.SSH_KNOWN_HOSTS_FILE, constants.RAPI_CERT_FILE, constants.RAPI_USERS_FILE, - constants.HMAC_CLUSTER_KEY, + constants.CONFD_HMAC_KEY, ]) enabled_hypervisors = lu.cfg.GetClusterInfo().enabled_hypervisors diff --git a/lib/confd/server.py b/lib/confd/server.py index 6c7f24dbbd5b1bfca9b4bd8d717c38a220dd6adf..e3dc58e07ecd796b21e058cb55a11a841bf529af 100644 --- a/lib/confd/server.py +++ b/lib/confd/server.py @@ -62,7 +62,7 @@ class ConfdProcessor(object): """ self.disabled = True - self.hmac_key = utils.ReadFile(constants.HMAC_CLUSTER_KEY) + self.hmac_key = utils.ReadFile(constants.CONFD_HMAC_KEY) self.reader = None assert \ not constants.CONFD_REQS.symmetric_difference(self.DISPATCH_TABLE), \ diff --git a/lib/constants.py b/lib/constants.py index 1174d5b8743ea9eaa781bbff642cb2a1e29f1dc0..49fca781c15eaf984dfa6370b7924b7025fb0ffe 100644 --- a/lib/constants.py +++ b/lib/constants.py @@ -99,7 +99,7 @@ SSCONF_LOCK_FILE = LOCK_DIR + "/ganeti-ssconf.lock" CLUSTER_CONF_FILE = DATA_DIR + "/config.data" NODED_CERT_FILE = DATA_DIR + "/server.pem" RAPI_CERT_FILE = DATA_DIR + "/rapi.pem" -HMAC_CLUSTER_KEY = DATA_DIR + "/hmac.key" +CONFD_HMAC_KEY = DATA_DIR + "/hmac.key" WATCHER_STATEFILE = DATA_DIR + "/watcher.data" WATCHER_PAUSEFILE = DATA_DIR + "/watcher.pause" INSTANCE_UPFILE = RUN_GANETI_DIR + "/instance-status" diff --git a/man/gnt-cluster.sgml b/man/gnt-cluster.sgml index e7947d049ed3870f8256576b2158c2f11aaaf738..450f4048c875360c17ea921ac1ca9db46c6fc29a 100644 --- a/man/gnt-cluster.sgml +++ b/man/gnt-cluster.sgml @@ -711,7 +711,7 @@ <arg>-f</arg> <sbr> <arg choice="opt">--new-cluster-certificate</arg> - <arg choice="opt">--new-hmac-key</arg> + <arg choice="opt">--new-confd-hmac-key</arg> <sbr> <arg choice="opt">--new-rapi-certificate</arg> <arg choice="opt">--rapi-certificate <replaceable>rapi-cert</replaceable></arg> @@ -722,7 +722,7 @@ Ganeti daemons in the cluster and start them again once the new certificates and keys are replicated. The options <option>--new-cluster-certificate</option> and - <option>--new-hmac-key</option> can be used to regenerate the + <option>--new-confd-hmac-key</option> can be used to regenerate the cluster-internal SSL certificate respective the HMAC key used by <citerefentry> <refentrytitle>ganeti-confd</refentrytitle><manvolnum>8</manvolnum> diff --git a/qa/qa_cluster.py b/qa/qa_cluster.py index d4efc50deb3b52713ac3412e8015648f2f4028de..5c88a04e9fe3921a4bb600e972789f3d44d076c7 100644 --- a/qa/qa_cluster.py +++ b/qa/qa_cluster.py @@ -152,7 +152,7 @@ def TestClusterRenewCrypto(): # Conflicting options cmd = ["gnt-cluster", "renew-crypto", "--force", - "--new-cluster-certificate", "--new-hmac-key", + "--new-cluster-certificate", "--new-confd-hmac-key", "--new-rapi-certificate", "--rapi-certificate=/dev/null"] AssertNotEqual(StartSSH(master["primary"], utils.ShellQuoteArgs(cmd)).wait(), 0) @@ -184,7 +184,7 @@ def TestClusterRenewCrypto(): # Normal case cmd = ["gnt-cluster", "renew-crypto", "--force", - "--new-cluster-certificate", "--new-hmac-key", + "--new-cluster-certificate", "--new-confd-hmac-key", "--new-rapi-certificate"] AssertEqual(StartSSH(master["primary"], utils.ShellQuoteArgs(cmd)).wait(), 0) diff --git a/scripts/gnt-cluster b/scripts/gnt-cluster index 0a4cc5cc783701933145d5efc1d5f08b68091e3b..1a58f11e6b584c0c1e2cc730aa1f84ba436cbc28 100755 --- a/scripts/gnt-cluster +++ b/scripts/gnt-cluster @@ -495,7 +495,7 @@ def SearchTags(opts, args): def _RenewCrypto(new_cluster_cert, new_rapi_cert, rapi_cert_filename, - new_hmac_key, force): + new_confd_hmac_key, force): """Renews cluster certificates, keys and secrets. @type new_cluster_cert: bool @@ -504,13 +504,14 @@ def _RenewCrypto(new_cluster_cert, new_rapi_cert, rapi_cert_filename, @param new_rapi_cert: Whether to generate a new RAPI certificate @type rapi_cert_filename: string @param rapi_cert_filename: Path to file containing new RAPI certificate - @type new_hmac_key: bool - @param new_hmac_key: Whether to generate a new HMAC key + @type new_confd_hmac_key: bool + @param new_confd_hmac_key: Whether to generate a new HMAC key @type force: bool @param force: Whether to ask user for confirmation """ - assert new_cluster_cert or new_rapi_cert or rapi_cert_filename or new_hmac_key + assert (new_cluster_cert or new_rapi_cert or rapi_cert_filename or + new_confd_hmac_key) if new_rapi_cert and rapi_cert_filename: ToStderr("Only one of the --new-rapi-certficate and --rapi-certificate" @@ -548,7 +549,7 @@ def _RenewCrypto(new_cluster_cert, new_rapi_cert, rapi_cert_filename, def _RenewCryptoInner(ctx): ctx.feedback_fn("Updating certificates and keys") bootstrap.GenerateClusterCrypto(new_cluster_cert, new_rapi_cert, - new_hmac_key, + new_confd_hmac_key, rapi_cert_pem=rapi_cert_pem) files_to_copy = [] @@ -559,8 +560,8 @@ def _RenewCrypto(new_cluster_cert, new_rapi_cert, rapi_cert_filename, if new_rapi_cert or rapi_cert_pem: files_to_copy.append(constants.RAPI_CERT_FILE) - if new_hmac_key: - files_to_copy.append(constants.HMAC_CLUSTER_KEY) + if new_confd_hmac_key: + files_to_copy.append(constants.CONFD_HMAC_KEY) if files_to_copy: for node_name in ctx.nonmaster_nodes: @@ -584,7 +585,7 @@ def RenewCrypto(opts, args): return _RenewCrypto(opts.new_cluster_cert, opts.new_rapi_cert, opts.rapi_cert, - opts.new_hmac_key, + opts.new_confd_hmac_key, opts.force) @@ -790,8 +791,8 @@ commands = { "Alters the parameters of the cluster"), "renew-crypto": ( RenewCrypto, ARGS_NONE, - [NEW_CLUSTER_CERT_OPT, NEW_RAPI_CERT_OPT, RAPI_CERT_OPT, NEW_HMAC_KEY_OPT, - FORCE_OPT], + [NEW_CLUSTER_CERT_OPT, NEW_RAPI_CERT_OPT, RAPI_CERT_OPT, + NEW_CONFD_HMAC_KEY_OPT, FORCE_OPT], "[opts...]", "Renews cluster certificates, keys and secrets"), } diff --git a/tools/cfgupgrade b/tools/cfgupgrade index 5ecc098d2fd47871de49b405817dcd4d9af6a212..fa6a8194dfc69b0121901dbba8867edbbe403b1c 100755 --- a/tools/cfgupgrade +++ b/tools/cfgupgrade @@ -121,7 +121,7 @@ def main(): options.SERVER_PEM_PATH = options.data_dir + "/server.pem" options.KNOWN_HOSTS_PATH = options.data_dir + "/known_hosts" options.RAPI_CERT_FILE = options.data_dir + "/rapi.pem" - options.HMAC_CLUSTER_KEY = options.data_dir + "/hmac.key" + options.CONFD_HMAC_KEY = options.data_dir + "/hmac.key" SetupLogging()